RadioShack Bankruptcy: Customer Data to the Highest Bidder?

The remnants of RadioShack’s retail empire went on the auction block on Monday, giving bidders the first chance to snap up the company’s trademarks, patents, leases—and the names, e-mail addresses, and phone numbers of millions of RadioShack customers.

For RadioShack itself, the stakes are enormous. Bloomberg News reported Tuesday morning that Standard General, a hedge fund that is one of RadioShack's creditors, has won the auction. Hanging in the balance on Thursday, when a federal bankruptcy court is expected to approve or reject the asset sale, is the continuation of the 94-year-old retailer's operations. Standard General has said it will try to keep the retail chain operating on a smaller scale.

RadioShack's customers—even those whose most recent purchase came years ago—could also find themselves sold off in the deal. The company included personal data in its bankruptcy auction as its own asset class. A website maintained by Hilco Streambank, which is serving as an intermediary for RadioShack, says that more than 13 million e-mail addresses and 65 million customer names and physical address files are for sale. Hilco Streambank is careful to note that the bankruptcy court might not approve the deals, and there have already been two legal filings in attempts to block the sale of customer data.

The broader challenge, filed last week by Texas Attorney General Ken Paxton, argues that RadioShack made an explicit promise to its customers not to sell their personal data. Paxton claims that 117 million people are included in RadioShack's customer data sale, which he says offers some details about shopping habits. The filing cites text from a sign displayed in RadioShack stores reading: “We pride ourselves on not selling our private mailing list.” State law in Texas prohibits companies from selling personally identifiable information in a way that violates their own privacy policies. On Monday, Tennessee's attorney general joined Texas's objection.

AT&T is also trying to stop RadioShack from sharing some of its consumer data for a different reason: The wireless carrier believes the information isn’t RadioShack’s to sell. AT&T worked with RadioShack to market phones, allowing RadioShack to build up a trove of information that includes, among other things, lists of AT&T customers. AT&T says it owns this data and wants RadioShack's records destroyed. Given that one bidder in the bankruptcy proceedings plans to co-brand some RadioShack locations as Sprint stores, AT&T is clearly concerned that the auction could give sensitive information to a competitor.

The court has appointed a “privacy ombudsman” to handle issues related to sensitive data, and that official hasn’t yet ruled publicly on either challenge.

A long list of RadioShack customers’ names and shopping habits has some market value, though it's unclear how much. In his legal challenge, Paxton asked that each bidder be required to break out its offer for the data so that the court could recalculate bids if it were to block the deal. It was not immediately clear how bids for consumer data might be valued.

While the focus on consumer data has become intense in recent years, the first legal challenge to the sale of such information during bankruptcy came 15 years ago. Toysmart.com, an online toy store, proposed selling information about its customers as part of a bankruptcy auction in 2000. The data proved to be the company’s single most valuable asset in bankruptcy.

The Federal Trade Commission sued to stop Toysmart from completing the sale, citing a company privacy policy that promised not to share information with third parties. The FTC found the proposal especially egregious because much of the information being offered was personal data about children that had allegedly been gathered illegally in the first place. “Even failing dot-coms must abide by their promise to protect the privacy rights of their customers,” said Robert Pitofsky, the FTC chairman at the time. Toysmart eventually destroyed the information, and the case led to federal legislation restricting asset sales in bankruptcy.

Whether RadioShack’s attempt to sell customer data withstands legal challenge could come down to the structure of the sale. An FTC spokeswoman pointed toward a 2011 letter addressing the bankruptcy of Borders, the bookstore chain, as a general statement of its approach to the issue. In that letter, the FTC said it realized that bankruptcy is a special case and agreed not to oppose the sale of personal data—with several conditions. The data couldn’t be sold as a stand-alone asset, the buyer had to be in the same line of business as the seller, and the buyer must agree to adhere to the same privacy policy. Any substantial changes to the privacy policy would require explicit consent from customers. (The FTC declined to discuss RadioShack specifically.)

Standard General certainly isn't in the same business as RadioShack, but its plan to keep stores open would seem to point to a path where it could argue for being allowed to use the data for the same use RadioShack originally intended. Whether that's enough to satisfy the court has yet to be seen.

Some lawyers who deal with corporate use of private data have seen situations like this as a cautionary tale for companies gathering personal data in the first place. A commitment not to share personal data “should raise red flags for the company’s investors and creditors, especially when personal information is a significant asset for the company,” wrote Lisa Sotto, an attorney focused on privacy issues, in 2010. Don't ruin a perfectly good asset, in other words, by making promises you're not going to want to keep.